{"id":"CVE-2026-108734","summary":"Frappe CRM 1.49.0 through 1.87.0 Missing Authorization via get_linked_docs_of_document","details":"Frappe CRM 1.49.0 through 1.87.0 contains a missing authorization vulnerability in crm.api.doc.get_linked_docs_of_document that allows authenticated users to read linked documents without permission checks. Attackers can name a lead, deal, comment or user they cannot read to obtain linked call log phone numbers, deal organizations and mention notification text.","modified":"2026-10-13T02:46:27.279313336Z","published":"2026-10-11T12:19:41.052Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-108734.json","cna_assigner":"VulnCheck","cwe_ids":["CWE-862"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-108734.json"},{"type":"ADVISORY","url":"https://hackmd.io/@haind03/frappe-crm-linked-docs-unchecked-read-20261010"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108734"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/frappe-crm-1.49.0-through-1.87.0-missing-authorization-via-get-linked-docs-of-document"},{"type":"PACKAGE","url":"https://github.com/frappe/crm"},{"type":"ARTICLE","url":"https://github.com/frappe/crm/blob/0d3910b456ef4fb913e77b29db011b3debc4f778/crm/api/doc.py#L684-L725"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/frappe/crm","events":[{"introduced":"7870748b417caa92e5d3de105d8ddeb28c495842"},{"fixed":"0d3910b456ef4fb913e77b29db011b3debc4f778"}],"database_specific":{"source":["AFFECTED_FIELD","DESCRIPTION"],"extracted_events":[{"introduced":"1.49.0"},{"last_affected":"1.87.0"},{"fixed":"1.87.0"}]}}],"versions":["assets-main","v1.86.0","v1.85.1","v1.85.0","v1.84.0","v1.83.0","v1.82.0","v1.81.2","v1.81.1","v1.81.0","v1.80.0","v1.79.1","v1.79.0","v1.78.2","v1.78.1","v1.78.0","v1.77.3","v1.77.2","v1.77.1","v1.77.0","v1.76.0","v1.75.0","v1.74.1","v1.74.0","v1.73.2","v1.73.1","v1.73.0","v1.72.0","v1.71.6","v1.71.5","v1.71.4","v1.71.3","v1.71.2","v1.71.1","v1.71.0","v1.70.0","v1.69.1","v1.69.0","v1.68.0","v1.67.1","v1.67.0","v1.66.2","v1.66.1","v1.66.0","v1.65.0","v1.64.0","v1.63.1","v1.63.0","v1.62.6","v1.62.5","v1.62.4","v1.62.3","v1.62.2","v1.62.1","v1.62.0","v1.61.3","v1.61.2","v1.61.1","v1.61.0","v1.60.3","v1.60.2","v1.60.1","v1.60.0","v1.59.3","v1.59.2","v1.59.1","v1.59.0","v1.58.5","v1.58.4","v1.58.3","v1.58.2","v1.58.1","v1.58.0","v1.57.11","v1.57.10","v1.57.9","v1.57.8","v1.57.7","v1.57.6","v1.57.5","v1.57.4","v1.57.3","v1.57.2","v1.57.1","v1.57.0","v1.56.6","v1.56.5","v1.56.4","v1.56.3","v1.56.2","v1.56.1","v1.56.0","v1.55.0","v1.54.0","v1.53.1","v1.53.0","v1.52.11","v1.52.10","v1.52.9","v1.52.8","v1.52.7","v1.52.6","v1.52.5","v1.52.4","v1.52.3","v1.52.2","v1.52.1","v1.52.0","v1.51.1","v1.51.0","v1.50.2","v1.50.1","v1.50.0","v1.49.1","v1.49.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108734.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}]}